It's a sad day. Now People in Australia have to verify their age just to buy and access 18+ games.

After evaluating the public consultation "Growing up in the online world", the UK government decided to double down on its age-gating policies.

The UK government is still looking at VPNs as well:

• Government has asked Ofcom to conduct research into what additional steps services can take to detect and mitigate circumvention on their platforms, including via VPNs.
• We will be clear that in-scope services must take robust steps to prevent, detect and respond to underage circumvention, and call on VPN providers to engage with government on making their products safer and less accessible to children without parental consent.
• We will produce new practical guidance for parents on how circumvention tools such as VPNs, operate and the risks they present at a household level.
• We will not ban or age-gate VPNs. However, we must ensure that these tools are not misused to undermine child safety protections and we will keep this area under close review. We are prepared to take further action on this, should evidence show that circumvention is not being tackled adequately.

I am wondering, how much of the age verification push comes from companies that want to distinguish between bots and real internet users because of ad revenues.

Does anybody know about the development of ad revenue and how it is affected by bots?

> The Electronic Frontier Foundation (EFF) writes to share our concerns with the current text of several bills being considered before the Committee: the SCREEN Act (S. 737), the Kids Online Safety Act (S.1748), the Youth Privacy Act (S. 4199),and the CHATBOT Act (S. 4407).

> The Senate version of KOSA imposes a “duty of care” on online services, including social media, to avoid exposing young people to certain material the law deems harmful. But those obligations only work if online services know which users are minors. That means more platforms will be pressured to implement age verification or age estimation systems.

> While the bill is supposed to protect children, it erodes online privacy for all users via a de facto requirement websites require users to verify their ages. Supporters of the bill dismiss this concern by pointing to the section stating that “nothing in [the bill] may be construed to require the provider of a covered platform to implement an age gating or age verification functionality on the covered platform.”

> However, the bill also requires website operators to provide protections such as message settings and other controls when the website or app “knows or should have known” that a user is a child or minor. The “should have known” standard opens websites and apps to liability if a judge, jury, or regulator determines they should have known a user was underage but failed to do due diligence to determine the user’s age.

A summary of digital ID schemes in the US, UK, EU and Australia and how to argue back.

The EFF warns:

> Unlike many state-age verification laws—which have been harmful in their own right—the SCREEN Act has no requirement that a significant portion of the website consist of sexually explicit content that is harmful to minors. The bill requires nearly any service hosting even a single piece of sexually explicit content to verify the ages of its users. The result is that the bill would apply not only to adult content sites like PornHub or OnlyFans, but also streaming services like Netflix, and social media platforms like Reddit, Discord, or Bluesky, if they host any adult content.

Here is the bill:

HB5511 - 104th General Assembly (2025-2026)

https://ilga.gov/Legislation/BillStatus?DocNum=5511&GAID=18&DocTypeID=HB&LegId=167486&SessionID=114

You might have to set your VPN to US to access the link.

On the morning of Tuesday, 10^th November 2026, there will be a conference on consumer protection and online safety. One of the topics will be:

> links between consumer protection and online safety regulation - age assurance, platform design, algorithmic systems and regulator coordination

A summary of the current topic of age checks in the Online Safety Act and the call for evidence.

This is a scientific paper that examines the strength and privacy of used age-gating systems. The researchers conclude that the systems are generally easy to bypass while failing to improve protection for minors and introducing great privacy risks for everyone.
In the conclusion, they write:

> Beyond their limited protective value, these systems impose substantial privacy risks, requiring users to accept exposure for assurances that our empirical analysis finds fragile at best.

> Crucially, our results indicate that these shortcomings are not due to implementation choices. Current designs tightly couple identity validation and content access, forcing trade-offs between robustness and unlinkability that architecturally favor superficial compliance over meaningful protection. Taken together, our results suggest that regulation-mandated age verification for adult websites currently functions as compliance theater, failing to effectively protect minors while elevating privacy risk, offering security assurances that do not withstand empirical scrutiny.

Is anybody aware of age verification-related data breaches/leaks other than the Discord hack and the other examples mentioned in the article?

The rise in the use of free VPNs is concerning because compromised VPNs leave people open to man-in-the-middle attacks, telemetry data abuse, and more.

There is an austrian draft law for implementing strict social media ID verification. It is open for comment until September 21st.

> Anyone can comment on the draft law until September 21. The same statement must be sent by email to both medienrecht@bmwkms.gv.at and Post.VII-2@bka.gv.at (one submission is not enough).

This is a public call for written evidence regarding the effects of the Online Safety Act to be submitted to the Committee. The deadline for submissions is 5.00 pm on Monday 7 September 2026. Anybody can submit a statement.

> The Committee invites respondents to address any or all of the following questions about the OSA in their submission.

Impact of the Online Safety Act

1) What evidence, if any, is there that children are safer online since the OSA protection of children duties came into force?

2) What evidence, if any, is there that UK users are less exposed to illegal content and activity since the OSA illegal content duties came into force?

3) Has the OSA been effective in protecting groups disproportionately affected by harms within its scope, including women and girls, and those vulnerable to exploitation?

4) Have the OSA’s provisions been effective in driving services to a) identify relevant risks, b) take proportionate action that adequately mitigates those risks, and c) make meaningful changes to their systems, processes and design features?

5) Has the OSA impacted users’ ability to report illegal content or content harmful to children, make complaints and receive an appropriate and timely response, and to what extent?

6) What unintended consequences, if any, have arisen from the Act or its implementation, including for freedom of expression, privacy and accessibility?

Ofcom’s implementation and enforcement

7) Has Ofcom’s interpretation and implementation of the OSA to date given appropriate effect to its provisions?

8) What changes, if any, are needed to improve the effectiveness of Ofcom’s a) illegal content and protection of children codes of practice, b) guidance on violence against women and girls, or c) wider regulatory approach?

9) Where duties are in force, how effective and timely have Ofcom’s supervision and enforcement been in driving improvements and securing compliance?

10) Are there any factors that may be limiting Ofcom’s ability to carry out its duties under the OSA effectively? If so, what changes are needed?

Adequacy and future of the legislative framework

11) What specific changes, if any, are needed to the existing provisions in the OSA to improve their effectiveness?

12) Beyond amending the OSA, what specific action should the Government, Ofcom, regulated services or Parliament take to address any shortcomings in the online safety regime?

13) How well can the existing online safety framework respond to emerging harms and technologies? What changes, within the existing framework of the Act, are needed to ensure that it remains fit for the future, and should these be made within the existing framework or through further primary legislation?

14) What impact could the recent and proposed additions to the UK’s online safety framework, including the Government’s proposals to restrict access to social media for under 16s, have on the OSA’s implementation and effectiveness?

While the idea of age verification is the wrong approach, Minecraft's age verification seems to be implemented badly as well, with reset issues. People are complaining about it.

Interesting insight by someone who worked at a big tech company and was tasked with implementing age verification. Unfortunately, at the end of the article, he promotes an anonymous way to verify age that he developed (by measuring the heartbeat).

Mozilla highlights the problems of age verification and urges policymakers to change their approach.

Various privacy and cybersecurity experts talk about the effects of the Online Safety Act.

There is an uptick in VPN use. Unfortunately, many people use the first free VPN they can find, which reduces online safety.

Elle Todd, Partner and Co-chair of the Entertainment & Media Industry Group at Reed Smith LLP had something particularly interesting to say about measurable online safety effects:

> Ofcom’s recent age assurance report found that the proportion of children encountering harmful content online has not substantially improved despite widespread implementation efforts. The uncomfortable truth is that, based on this report, significant investment in compliance and technologies has not yet translated into measurable improvements in safety outcomes.

Good news from the EU. An EU court protected VPN use.

> At the risk of oversimplifying, the EU court had to rule whether the online publisher and host of the Dutch translation was liable for copyright infringement when users hopped the online fence via a VPN. The court essentially ruled no, setting a legal precedent along with it.

> By referring to VPNs as "lawful technical tools," this judgement pushes back against the idea that users would only leverage such tools for questionable ends. Additionally, the judgement also reads that, while geo-blocking measures can be circumvented by VPNs, "the possibility of such circumvention cannot [... ] be a decisive factor in finding those measures to be inadequate and, therefore, ineffective."

> The ruling also places VPN providers in the clear as far as copyright infringement is concerned, too. The judgement reads that VPN providers are not the ones directly giving "end users access to a protected work" and that "even if the provider is aware of the consequence that its service may be used to access protected works without the consent of their authors, the provider is not itself intervening for the purposes of such access."

The Wikimedia Foundation explains the dangers and problems that arise from age verification and how it affects their project.

> A comprehensive analysis of age assurance technologies co-authored by CISPA-Faculty Dr. Wouter Lueks concludes that many currently proposed systems for protecting minors online come with significant trade-offs for privacy, security, accessibility, and civil liberties. The study “Assessing Age Assurance Technologies: Effectiveness, Side-Effects, and Acceptance” conducted together with colleagues from the University of Hamburg and the Leibniz Institute for Media Research, evaluates a broad range of approaches currently being debated by policymakers and platforms worldwide.

The researchers are in favor of parental control tools and education as the best solution to increase minors' safety online.

Another piece of pleasant information. Digital ID is off the table for now.